CVE-2023-6835

published 2023-12-15

CVE-2023-6835: Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.

Priority P4 27 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C N I L A N

Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	api_manager	—	—
wso2	iot_server	—	—
wso2	wso2_api_manager	>= 2.2.0.0 < 2.2.0.16	2.2.0.16
wso2	wso2_api_manager	>= 2.5.0.0 < 2.5.0.17	2.5.0.17
wso2	wso2_api_manager	>= 2.6.0.0 < 2.6.0.24	2.6.0.24
wso2	wso2_iot_server	>= 3.3.1.0 < 3.3.1.17	3.3.1.17

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20